I got hacked: My Hetzner server started mining Monero

Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?

Re: I got hacked: My Hetzner server started mining Monero

#6

Post by [deleted] » Wed, Dec 17, 2025, 9:39 PM UTC

[deleted]

Re: I got hacked: My Hetzner server started mining Monero

#7

Post by minitech » Wed, Dec 17, 2025, 9:43 PM UTC

> Here’s the test. If /tmp/.XIN-unix/javae exists on my host, I’m fucked. If it doesn’t exist, then what I’m seeing is just Docker’s default behavior of showing container processes in the host’s ps output, but they’re actually isolated.

  /tmp/.XIN-unix/javae &
  rm /tmp/.XIN-unix/javae

This article’s LLM writing style is painful, and it’s full of misinformation (is Puppeteer even involved in the vulnerability?).

Re: I got hacked: My Hetzner server started mining Monero

#8

Post by whalesalad » Wed, Dec 17, 2025, 9:44 PM UTC

mrkeen wrote: post #3

whalesalad wrote: post #2

[flagged]

Someone mined Monero on my server a few years ago. I was running Jenkins.

that was a canon event

Re: I got hacked: My Hetzner server started mining Monero

#9

Post by _fqqr » Wed, Dec 17, 2025, 9:46 PM UTC

This article is very interesting at first but I once again get disappointed after reading clear signs of AI like "Why this matters" and "The moment of truth", and then the whole thing gets tainted with signs all over the place.

Re: I got hacked: My Hetzner server started mining Monero

#10

Post by zamadatix » Wed, Dec 17, 2025, 9:46 PM UTC

I don't use Docker for my containers at home, but I take it by the concern that user namespacing is not the employed by them or something?